On the Horizon — Not Yet Law
Arkansas comprehensive privacy law — disputed status
Included specifically as a warning: this is the single most-repeated inaccurate claim found during research, and it's worth knowing it's disputed rather than assuming a secondary source is right.
Status: Genuinely conflicting sources. Arkansas's real 2025 bill (SB 258, the "Arkansas Digital Responsibility, Safety, and Trust Act") died at sine die adjournment on May 5, 2025. Separately, several low-quality secondary sources describe an already-"enacted" Arkansas Personal Data Protection Act (claiming a 2023 signing date and specific 25,000/50%+10,000 thresholds) — but no actual bill number, session-law citation, or Code section could be found to support that claim, which is assessed as likely fabricated or confused with another state.
Treat Arkansas as having NO comprehensive privacy law currently in force. If you've seen otherwise cited elsewhere, verify directly against Arkansas Code Online or Justia before relying on it.
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual revenue, data volume, and data types.